Adam Palmer is the CISO of First Hawaiian Bank, the largest bank in the state of Hawaii, with almost $30 billion in assets and operations across Hawaii, Guam, and Saipan. With 25 years in cybersecurity, he began as a U.S. military officer, worked on both the vendor and operational sides of the industry, and spent ten years in cybersecurity roles in Europe before taking on his current role just under six years ago. Adam leads the bank’s technical security, governance, operational management, and risk reduction efforts, and he thrives on transformation work, building programs and operating models from the ground up. He joins the show to talk about the advantages of a mid sized bank, why he insists on a human in the lead of AI driven decisions, how he vets vendors in a regulated environment, and why he believes fighting AI with AI is the only way to keep pace. 

Here’s a glimpse of what you’ll learn: 

• Why Adam says a mid sized bank’s agility can be a real advantage over a larger institution
• Why Adam counsels patience and planning, including months of assessment, over chasing a quick win
• How start small, scale smart, govern carefully shapes an AI committee that reviews every use case
• Why Adam refuses to be the department of no, and how he presents trade-offs so leaders decide with eyes open
• What human in the lead, not human in the loop, means for a regulated security operations center
• Why Adam wants vendors to prove transparency instead of wrapping an AI buzzword around a traditional tool
• Why Adam argues cyber risk should be quantified in business terms instead of red, yellow, and green heat maps
• Why Adam believes security leaders must fight AI with AI, and why crisis mode is the wrong response
  
  
  

In this episode…

Sponsor for this episode...

This episode is brought to you by CyberLynx.

CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection.

We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO.

Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.

Check out previous episodes:

$20 a Seat Snuck In on Us: The Hidden Budget Problem of AI with Michael McAndrews - Ep 245

Air Gaps Just Don’t Exist Anymore: Securing Critical Infrastructure with Tony Bryson - Ep 244 

Human or Agent? Eight Identity Scenarios to Test Any AI Vendor with Marina Kelly - Ep 243

Transcript: 

Adam Palmer

CISO

First Hawaiian Bank

Matthew Connor: Matthew Connor here, host of the Cyber Business Podcast. Today we're joined by Adam Palmer, CISO of First Hawaiian Bank. Adam, welcome to the show.

Adam Palmer: Hi, good morning.

Matthew Connor: It is morning over there for you, Adam. Thanks for being on the show. Before we get too far in, a quick word from our sponsors.

Sponsor Break — CyberLynx: Hackers are using AI to conduct machine-speed attacks. Is your security keeping up? CyberLynx sells industry-leading AI-powered cybersecurity solutions that detect threats in real time, so you know about an attack before the damage is done, not after. Learn more at cyberlynx.com. That's cyberlynx.com.

Matthew Connor: And now, back to our show. Adam, for those who aren't familiar, can you tell us about First Hawaiian Bank and your role there as CISO?

Adam Palmer: Yeah, sure. I've worked in cybersecurity for twenty-five years. I began as a U.S. military officer, and I've been on both the vendor side and the operational side, where I am now. I lived in Europe for ten years working in various cybersecurity roles. I've been CISO here at First Hawaiian Bank for just under six years. We are almost a thirty-billion-dollar asset bank, a major regional bank in the western United States. We're the largest bank in the state of Hawaii, and we have operations across the Pacific, in Guam and Saipan in addition to Hawaii.

Matthew Connor: You know, every time I hear about a bank and cybersecurity, I immediately go to Chase and how much they spend, I believe it's something like fifteen billion dollars a year on cybersecurity. And last I heard, they have more attempts on their network than the United States government, at least according to Chase, and I think that's probably true. So every time I think of a bank, and these regional banks, I think of Chase, and I can't help but wonder, how do you sleep at night? I think the bad guys are always coming after either money or, you know, government things, so that has got to be a real challenge when you don't have a fifteen-billion-dollar budget. How do you manage all that?

Adam Palmer: I worked at a global bank prior to becoming the CISO here at First Hawaiian, and I lead all of our technical security, governance, operational management, and risk reduction efforts and our program. I think working at a mid-sized bank actually has some advantages over the larger banks. I know that working at a larger bank, yes, the budget was huge, but a large ship turns slower. One of the most fun parts of my job is that I get to do some more advanced things because we're more agile, and I think that's a major advantage we have in terms of what we can do. Smaller doesn't necessarily mean less advanced. We have all of the same programs, the same or similar risks, and many of the same areas as a larger bank, just at a different scale. And in some of those areas we can actually move faster, look at more advanced tools sometimes, and implement them quicker. In 2024, our bank was named one of the Forbes top fifty most cybersecure U.S. banks, so I'm really very proud of that.

Matthew Connor: That's amazing. So what advice do you give to other, let's say even smaller banks, other mid-sized and smaller banks, to reach the level you've achieved when it comes to cybersecurity?

Adam Palmer: I would say to any CISO, as you first step into the seat, and this is what I did, I think the greatest skills you can have are patience and planning. Many people jump from fire to fire immediately, and don't necessarily give in to the pressure for a quick win. When I came here in early 2021, I spent the first several months doing very careful assessments of the program, looking at the overall maturity, creating a multi-year plan, and then executing on that. I think it created better effectiveness and execution. So at a smaller bank, use your agility, use your size as an advantage, plan carefully and thoughtfully, and then have a strong execution plan that you can deliver.

Matthew Connor: Sound advice. But do you find it's easier to work through having frameworks already in place? Or is this something where things are changing so rapidly that the frameworks, while helpful, aren't everything you need them to be, and you have to adapt and adjust on your own?

Adam Palmer: We always want to align with a standard and know that we are holding ourselves accountable to benchmarks and standards. I would call myself someone who likes to transform things, and I think that's true of many of the roles I've had. Early on at the global bank, I helped co-lead global second-line cyber risk, and here I've helped really grow this program as a mature, CISO-driven program at the bank. Even on the vendor side, when I worked as a field CISO, I stepped into programs where I was the first person in that job. I really enjoy transformation and creating something myself. So I would say you absolutely have to align to frameworks and hold yourself accountable to what industry standards are, but I think it's a lot of fun, and I personally like to be able to build something and create my own operating model as well.

Matthew Connor: Yeah. Well, when you talk about transformation, I don't think anything's quite as transformative as AI, it's kind of transforming everything. What role do you see AI playing in banking?

Adam Palmer: There are absolutely two sides of it. We could talk about AI in terms of the banking side, the business side, of how they're using it to advance the business. I'm also looking at how AI can improve security operations as well.

Matthew Connor: Yeah, I think they're both really interesting. Let's start on the business side, because I think that applies to most businesses, and there's a lot going on there. How do you see AI playing a role on the business side of banking?

Adam Palmer: From a security perspective, I believe that "start small, scale smart, govern carefully" is the mantra I have. We don't want to implement AI just to say we're implementing AI. I'm involved with our AI committee here at the bank, and we carefully review every use case. So it's a matter of implementing AI when it has a legitimate, understandable, articulated business value, and then making sure, as the CISO, that my team has designed the appropriate guardrails for that.

Matthew Connor: And I think therein lies the challenge, especially in today's day and age, where things are progressing so rapidly. I think, unlike any time in the past, users want access to tools at a much faster pace, and that puts a lot of demand on the security side of the house to come up with the governance, the policies, and the procedures, and make sure they're being implemented to support the business needs, but also to do that securely. I think that's a real challenge for CISOs today. Is that what you're experiencing?

Adam Palmer: It's a challenge, but in a good way. I'm a firm believer we can't be the department of no. If you just say no, people will develop shadow IT or find ways to evade your controls. So you have to be solution-driven. When I approach AI risks, I absolutely let the business first identify where they think there's value. Then, even in a high-risk situation, I try to approach it by asking, what are the trade-offs? Ultimately they can decide, and I want to present to them what the trade-offs are, what the risks are. Whatever decision is made should be made with eyes open and a clear understanding of what those risks are and what the costs are. I think that's my job. My job isn't to block it, my job isn't to say no, it's to present decisions to our leadership.

Matthew Connor: Yeah, I think that's about as good as you can do there. And then on the security side of things, how do you see AI playing a role?

Adam Palmer: It's an interesting question. In fact, I spoke at Gartner at their Cyber Security Summit in Washington, DC, earlier this year, and I was flattered, I was told my presentation was the highest-rated presentation of the conference. What I presented on was how we gained board confidence and improved executive confidence through the transformation of our security operations center, and a big piece of that was looking at components of artificial intelligence. I think there are very significant gains that can be made in your mean time to detect and your mean time to resolve incidents, and certainly efficiency gains that can be achieved through AI. You have to validate the AI tools, they have to be auditable, and there has to be some transparency. Now, I work in a regulated environment, so there has to be transparency, and our ability to control and understand it, and there has to be a human in the lead. I say not human in the loop, but human in the lead, who ultimately makes critical decisions. But there are definitely capabilities AI presents that enable us to move at machine speed, which is critical, because the attackers are now moving at machine speed also.

Matthew Connor: Well, I like that, the human in the lead. Let's explore that a little bit. What does that mean exactly, in today's AI age, where everything is moving so rapidly? AI is able to come up with a lot of great ideas and execute on a lot of things, but obviously it still needs a lot of oversight and governance. How do you implement human in the lead?

Adam Palmer: It's using AI to prioritize and help us focus first on what matters most. But ultimately, especially in critical areas, we try to ensure that when there's a critical decision to be made, human judgment is ultimately the decider. So we ensure that the SOC operator has the top incidents in front of them, and the AI can be used to collect information, gather intelligence, and review and consolidate reports, which saves a lot of time in, say, log investigation or these types of very time-intensive administrative tasks. But for critical decisions, I want the human judgment of one of my analysts looking at it and making the final decision.

Matthew Connor: Yeah, I think it's tough for people to get a balance and a feel for AI being a tool and an assistant, not a replacement, not a "just go ahead and do it." I think the term "agentic AI" leads people to think it is an independent agent with autonomy, and while a lot of people have tried to make it that, we're clearly not at that stage yet in terms of where the technology is. We're advancing rapidly. Go ahead.

Adam Palmer: No, I absolutely agree. When I look at a lot of the AI security operations space right now, it is a bit of the Wild West. The vendors that stand out are the ones who can show transparency and are doing innovative things, but are not just wrapping a traditional tool around the AI buzzword and adding it. I want to see something that is not just incrementally but truly advanced and better than what I can achieve without it, and that is also transparent, so that I can show exactly what the AI is doing to my auditors and to regulators, which is demanded. You can't implement those types of tools in a regulated environment in a reckless way. I think it starts with us having strong control over what any type of AI is doing, having the human in the lead, and having good guardrails. AI really starts with our own tools, and making sure that we have full control and transparency of our own security tools.

Matthew Connor: Yeah, I couldn't agree more. I think everybody needs to have that same perspective, even when they're not in a regulated environment, it's just the smart thing to do. And I think that today we can move both quickly and safely. For whatever reason, people tend to think you can only have one or the other, and I'm not sure that's necessarily true anymore, especially when you're using this technology properly, in the right ways. When we start talking about the right-fit technology, you kind of talked about it a little bit, like just bolting an LLM onto a traditional tool, yay, it's AI now, give me more money. I'm not sure I'm going to. For a lot of people, a shiny new toy is really cool and fun, but is it really solving a problem? A lot of the products coming out are cool and innovative, that's great, we need that. However, on the business side, do I have that problem, and is that solving the problem that I need solved? That's often the question that goes unanswered because it's so cool, I just want to use it. Okay, but do you really need it? Does it fit? And to your point, is it transparent and auditable? Does this actually help us achieve our mission of being secure and being compliant? I think that often gets missed. But you're boots on the ground, you're getting hit with this all the time from a million different vendors. Is that your take on things?

Adam Palmer: Yeah, and I think optimization really shows up in outcomes, not just in your budget. This is an area I'm very focused on: are we reducing risk with any decision, or are we just trying to do something because it seems cool? Don't implement AI in our own stack just because we want to say we're doing that, ask whether it is really reducing risk. One of the things I'm really looking at, and have been working on, is cyber risk quantification. I really do believe we have to speak in business terms. I don't understand why, on so many levels, security still uses heat maps and talks in these red, yellow, green metrics, when the board doesn't understand "I want you to give me so much money because I'm moving the risk from red to yellow." Well, what does that really mean? I really believe it's not the only metric. Of course, if I'm presenting to a board, I'm not going to rely solely on statistics or risk quantification, but I believe every other area of the business presents its priorities in terms of numbers, dollar values, and quantification. So something we really look at with AI, and any tool we implement, is how we quantify what the value is. I think that's an approach that resonates strongly with CEOs, with boards, and with executive leadership.

Matthew Connor: I couldn't agree more. And I think what a lot of people struggle with is perhaps the sheer quantity of options now. I'm of the school of thought that if you're not a startup, I'm not sure how easy it is, or if it's right necessarily, for you to be using some startup product in your organization. I think that's tough. Even though there may be some phenomenal ones, and getting in early is a great idea, don't get me wrong, I think it often comes down to using something like the Gartner Magic Quadrant to say, look, here we go, they've gone through the process of filtering these out and analyzing them, making my job a little easier. Not plugging Gartner here or anything, but I think having some sort of filtration like that really helps cut down your options, because there's only so much time in the day, you can only examine so many products at once, and sometimes they're already obsolete by the time you finish evaluating them. How do you deal with the onslaught of options?

Adam Palmer: It's interesting you mention that. I think very highly of Gartner and appreciate all that they deliver, but I do think there's one blind spot sometimes, which is that if you focus solely on some of the reporting, you can miss smaller companies and startups. As I mentioned, we have taken chances working with smaller companies when we thought they had a very advanced tool. Of course, we evaluate that very closely, and we make sure we have appropriate controls over what they're doing. But if a small company comes to us with a very highly valuable tool with strong transparency, we try to appreciate that, and we have given a shot to those types of companies, and I think there's real value there. I think it is a challenge, though, as you said, to find the ones in that category that are worth looking at through all the noise. When I walk the floor at RSA, or at other events like Black Hat, there are so many vendors, it's just overwhelming. So one of the challenges really is sifting through what's real and what isn't.

Matthew Connor: Yeah, I think it's a real challenge for everybody, it's a lot. And I like your approach of being able to find the newer companies that aren't large and that do have an exceptional product. I guess it comes down to how you find that diamond in the rough, if you will. Was it just serendipity? Did you get a call? How did that happen for you, and how did it work out?

Adam Palmer: I view part of my job as staying very close in conversations with some of the investors. We're obviously working with other CISO groups, but sometimes I talk to people who are involved with some of those early-stage companies. Even if we look at a good company and it's not something that yet has the size or maturity that we can work with them immediately, sometimes it's at least being aware of that, and then, if they are successful and achieve maturity, we can eventually work with them. So I look at a significant part of my job as identifying those areas. We try not to be dependent on one single platform, because that's also a single point of failure, so there are a lot of advantages to having other options. Obviously we try to consolidate as much as possible, and we achieve a lot of efficiency through that. But additionally, we try to consider these other tools that offer unique value, and if the company can prove themselves to us as credible and mature, then we are definitely open to giving them a chance.

Matthew Connor: I love it. Well, let me ask you, when it comes to having these different products, and I like the idea that a single pane of glass is a single pane that, when it breaks, it's all your glass, right? So there's definitely some wisdom there, and obviously those two schools of thought. Are we moving toward a day now, thanks to AI, where you're pulling those together? I'll give you an example. You can now basically build your own SOC, if you will, pull in all the data, connect to all of your platforms, and get it all in there over a weekend, in hours, which used to be the benefit of the SOC. I'm not saying everybody should or shouldn't, and you don't build your own SIEM product just because you can, or maybe you do. Let me make that the question: are we moving toward a future where you're going to be able to securely and easily build out the products you want? We're kind of seeing glimpses of that, through a fuzzy picture right now, where you can just vibe-code that up pretty quickly, and they're getting smarter and better with the code. So in the not-too-distant future, let's put on our futurist hat, is that where things go, where you can build out a very sophisticated, very secure, unique product that pulls in all the data and all the different products you're using, with one corporate interface? SOC, SIEM, SOAR, you name it, your own thing that you've built and control with your own words, and now you've got access to it the way you want in a very quick and easy way. Is that the kind of future you think we might be moving toward?

Adam Palmer: I think we are moving toward a future of more customization and localization. When I was in a global security role, I was often focused on the idea that we could have a global strategy, but we had to have local tactical execution. I think the same is true of tools, and we're starting to get closer to that level of flexibility. The good vendors I work with have the ability to adapt their tools, integrate them, and customize them to some extent. Obviously there are often core processes I expect to be the same, but I think we are getting closer to that ability, and I think the best vendors are customizing for unique customer needs and the outcomes I want to achieve.

Matthew Connor: You know, I often think so. I've had a Tesla for a lot of years now, pretty much since the beginning, and it's been fun to see the trajectory of full self-driving, which used to be called Autopilot. Early on, and I've used this analogy a bunch of times, it was kind of like a drunk toddler at the wheel. It was really dangerous, and you're like, what are you doing, you're clearly drunk and you're a toddler, you should not be driving the car. Then it became a teenager, and it evolved, and now it clearly has its license. Just about a month ago, Tesla released their data, I think it was 1.8 billion hours driven on full self-driving, and they found that it's statistically eight times safer than a human driver. It's been fun to see that growth over time, because just about a month or so ago, we were coming back from New York, in the left lane on full self-driving, and this car right beside us swerves into our lane really fast, too fast for me to respond. The car moves over just enough, slows down just enough, doesn't overreact, accident avoided. We didn't slam into the median, didn't hit the brakes and have the guy behind us hit us. It all happened way faster than I could have reacted. Within half a second I was like, all right, I'm out, I am no longer fast enough. And I see now that at thirty frames per second, it takes four frames for the Tesla's full self-driving to identify something and make a change. That was a real-world example, and seeing this kind of AI use in the physical world, with real-world applications, I think parallels what we're seeing in other places. I think we're a little further behind when it comes to security products. I don't want to say we're a drunk toddler, that's a fun thing to say, but I don't think it's accurate for where we are. I think we're developing and getting there, we're in the teenage years. And I promise I'm getting to a question here. Using that same analogy, it's still early, and we're getting glimpses of where it's going to go. Like with full self-driving, even though it was a teenage driver, you could see we're going to that future where people aren't going to need to drive. While we're not fully there yet, we're right on the cusp of people just not ever driving. On the security side, there are so many products out there using AI in innovative ways, and even machine learning, which has been around for quite some time. You see things like Darktrace and Abnormal Security using machine learning, which makes perfect sense for seeing when something abnormal has happened. Oh great, that's a perfect use for machine learning, not the best for an LLM, not the best for a human, but to be able to monitor your network, your endpoint, your email, and say, well, that's not normal, let me stop that. I think that gives us a glimpse of the future, where Jane in accounting is just able to do accounting stuff, because we're going to have security tools that allow us to do security, and allow the accounting people to do accounting and the ops people to do ops. I know it's a hot take, but I think we're going to get there, to where the weakest link is no longer the person at the keyboard, because we have such strong oversight and immediate vision of what's happening. We're able to prevent things from happening at machine speed. So the email comes in that they might click on a bad link, and now I've got you, with ninety-nine point nine nine percent effectiveness, or a hundred percent. I think that day's coming, and I'm curious if you think that's just being Pollyanna, overly optimistic future thinking, or if you think that day could arrive as well.

Adam Palmer: I do think that identity is our perimeter, and AI agents and human and non-human identities have to be monitored and controlled effectively, because they can do authorized activities that could still be malicious. So you have to have strong controls over that activity, and it's moving faster than ever before in this development. To answer your question about AI, I will say, in general, that I look at it this way: the danger is not necessarily moving too slow. Many people think, I need to adopt quickly. I say this being fully supportive of trying to move fast, but I think the danger is moving too fast. It goes back to my earlier comment about starting with real, valuable use cases, governing them carefully, and validating that you have control. I think there's real danger in this time we're in, where it is a bit of the Wild West and there is a lot of unproven capability, and not all of the tools and companies are mature enough or have the appropriate controls, so we have to be very careful. And I absolutely think the future is going to be heavy AI adoption and implementation in our business processes, but it just has to be done in a secure way. I believe the companies that are going to be successful are the ones taking that balanced approach, where they understand they want to do AI and get the value as quickly as possible, but they want to do that in a controlled, secure way.

Matthew Connor: Well, let me ask you, when you take this controlled approach, and I don't want to say conservative, but obviously everybody should take a controlled approach to implementing AI in security.

Adam Palmer: For sure.

Matthew Connor: It shouldn't be haphazard or reckless. But I guess I'm wondering, as you balance progress and control and being pragmatic about the whole thing, looking at the fact that you're fighting fire with fire, it is no longer a knife fight, the bad guys are using guns. Even if we have the best of everything, fully patched, using all the best practices, and everybody's doing their job, I think the trump card, if you will, is that the bad guys can now, with a prompt, some kid in Lithuania, and I don't know why I always pick on Lithuania, have a zero-day exploit and get past all of your security. I think that's a real concern. So how do we balance that? Is that just something where we have to say, well, that's a risk, and we have to prepare for being breached and prepare for a disaster, there's no avoiding it a hundred percent? Or is it, nope, we've got to fight fire with fire? How do you balance that?

Adam Palmer: I do think the good guys have to have AI. We have to fight AI with AI, and we are getting into machine-versus-machine territory. The only way we can respond to the vulnerabilities and the speed that offensive AI capabilities create is to have equally strong, or stronger, AI capabilities on the security side. That's why I believe it's so important, and our bank and I, strategically, have been planning for this for several years now. Candidly, given all the discussion and the planning, I'm sometimes surprised at security leaders who are acting with such despair or in crisis mode over some of these developments. There are always new risks, and of course we're trying to refine what we do, but for a very long time now we've been preparing to have our team capable of moving at machine speed and looking at new threats. I think any strong security leader has to be future-forward thinking, and we don't base our security defenses on yesterday's strategy. We're always trying to think about what the strategy and tools are that are going to defend us against tomorrow's threats.

Matthew Connor: Well said, Adam, I cannot thank you enough for coming on today, I think that was beautifully put. But before we go, can you tell everybody where they can find out more about you and more about First Hawaiian Bank?

Adam Palmer: Sure. Obviously our bank has a web page, and I'm always happy to interact and connect with people on LinkedIn. In fact, if I'm allowed one self-promotion, about once a week I post a video where I talk about security from a beach in Hawaii. I wear an Aloha shirt, and I keep it serious, I try to share some thoughtful ideas about what I think about security, but I film it from this beautiful place that I'm lucky to live in. So connect with me, and once a week you get to check out a little security topic from Hawaii.

Matthew Connor: They are great topics, and I do love the videos and the Hawaiian shirt. Adam, again, thanks for coming on. Until next time.

Adam Palmer: Thank you, my pleasure. Aloha.